Privacy Policy

Last updated: October 25, 2026

In plain language: what data Imperia The1 collects, why, who it goes to and how to delete it. We do not sell data. The ad networks Meta and TikTok receive only events such as an app install or a subscription start — to measure advertising, and only within your choices (section 9).

1. Who is responsible for your data

The data controller is Aram Elbakyan (Aramayis Elbakyan), a private individual, Dubai, UAE, who is also the seller of the IMPERIA THE1 app on the App Store. For any question about data: support@jointhe1empire.com.

The service is intended for people aged 18 and over. We do not knowingly collect data from minors; if such an account comes to light, we delete it.

2. What data we collect

Account — email, name, sign-in method (email code, Google, Apple, Telegram), and your Telegram ID if you linked Telegram.
Intake form and profile — age, height, weight, goal, training level, restrictions and injuries, daily schedule, time zone.
Measurements and progress — weight, girths, body fat percentage, completed lessons and modules, finished workouts, log entries, saved recipes.
Photos — body photos for composition and progress estimates, food photos for diet review, your avatar.
Blood test results — a photo or PDF of the report and the values recognised from it.
Metrics from Apple Health and Health Connect, if you grant access: heart rate and resting heart rate, steps, distance, calories, sleep, workouts. Plus heart rate from a BLE chest strap during a workout.
Outdoor runs — the GPS track (timestamped coordinates, up to 600 points per session), distance, pace, splits.
Conversations with the AI mentor — messages, photos and files you send, chat history.
Payment metadata — plan, period, amount, currency, payment status, the subscription id at the provider. We never see or store card details. For USDT payments we only see the blockchain transaction.
Technical data — IP address, device and browser type, request timestamps, client-side errors, push notification tokens. Used to fix failures and catch abuse.

3. Health data — separate consent

Measurements, body and food photos, lab results, heart rate, sleep and everything you tell the mentor about how you feel are health data, a special category. We process them only on the basis of your explicit consent (GDPR Art. 9(2)(a)).

You give that consent with a separate checkbox at sign-up — separate from accepting the terms — and you may decline it: the platform still works, only the AI mentor is switched off. You can withdraw it at any time in the same place you gave it: your account → "My data". Withdrawal switches off the chat and the transfer of data to Anthropic and leaves the rest of your subscription untouched. It applies going forward and does not undo processing that has already happened.

Sharing Apple Health / Health Connect metrics with the mentor, and writing your meals back into Health, are separate toggles that are off by default. Until you turn them on, that data never reaches the AI.

3.1 THE SON sleep program

THE SON (the sleep program, "THE СОН") is an optional program inside the app that helps you build a sleep routine: wake time, evening wind-down and sleep window. It is not a medical device and not treatment, and we do not diagnose. If your answers or data look like a reason to see a doctor, the app says so plainly. The program is for adults (18+) and is not yet available in every region.

We receive the following only if you turn the program on:

Start-up questionnaire answers — goal, work and wake schedule, how many nights a week and for how long sleep is a problem, optionally coffee and alcohol. Safety answers (snoring with breathing pauses, falling asleep at the wheel, pregnancy, epilepsy, bipolar disorder, mood) are turned into yes/no flags on your phone. Only the flags reach our server, not the answers themselves.
Short sleep questionnaires — how you sleep, daytime sleepiness, breathing in sleep. Only the total score and level are stored, not the answers to individual questions. For the breathing questionnaire the server reads your age, height, weight and sex from your profile.
A summary of each night from Apple Health — when you went to bed, fell asleep and woke, how long you slept, how long you were awake in the night, and the source (for example, Apple Watch). We do not take a minute-by-minute sleep record.
Resting heart rate and heart-rate variability overnight, if your device recorded them. They are compared only with your own usual values over recent weeks, to suggest "take it easy today".
The sleep diary that you fill in yourself: sleep time, alertness, sleepiness, coffee, alcohol, late meals, a note of up to 280 characters.
Alarm settings and records of when the alarm rang.

For its suggestions the program also uses data already in your account: age, goal, workouts and "energy/wellbeing" answers. It does not use calories or food composition.

Basis. This is health data. We process it on your explicit consent (Art. 9(2)(a) GDPR), which you give when you enter the program. You can turn the program off and delete its data at any time.

AI coach and sleep. Aram sees sleep only when the "Share Health data with the coach" switch is on (in the sleep settings it is called "Aram sees my sleep" — it is the same switch). Then Anthropic receives a short 7-day summary: program stage, sleep window, average sleep time, time to fall asleep, wake-time regularity, safety level. Individual nights, the diary, notes and questionnaire answers are not sent to the AI. Turn the switch off and the summary disappears from the next message. Oura and Withings data is never sent to the AI.

What we do not do. We do not sell sleep data, use it for advertising or pass it to ad networks: Meta and TikTok receive no sleep values. The program's internal statistics count only step names such as "opened a lesson". We do not write sleep to Apple Health, we only read it.

Wearables through the manufacturer's cloud. If you yourself connect Oura, WHOOP, Google Health (Fitbit), Withings, Garmin or Polar, we receive summaries of your nights for the last 14 days and then new ones as they appear, and from Oura also resting heart rate and heart-rate variability. From Withings, if you connected it, we additionally receive overnight heart rate and heart-rate variability, snoring and apnea-hypopnea index (AHI), daily activity (steps, distance, calories), weight and body-fat percentage. They are used for your sleep plan, smart alarm, recovery and load estimates; a high AHI over several nights prompts a "see a doctor first" notice, and we do not diagnose. Withings data is never sent to the AI. To do this we keep the access key to your account at the manufacturer in a separate file readable only by the server. The manufacturer may tell us about a new night, and then we request it. You can disconnect a device with one button in the program: the key is deleted, and we revoke access at the manufacturer where their service allows it. The manufacturer processes your data under its own policy.

4. Why we use data, and on what legal basis

Access to the platform, your account, progress, programs — performance of our contract with you.
Payments, renewals, receipts, fraud prevention — performance of the contract and our legitimate interests.
AI mentor, lab and photo reviews, individual plan — your explicit consent (section 3).
Service emails and subscription notifications — performance of the contract.
Newsletters and non-service reminders — consent; one-click unsubscribe in every email.
Logs, backups, security — legitimate interests and legal requirements.
Payment history — a legal obligation: accounting and tax reporting.
Analytics and advertising on the public site — only with your consent in the cookie banner (section 9).
Ad measurement in the iPhone app — app events go to Meta and TikTok; the device advertising identifier only if you allowed tracking in Apple's prompt (section 9).

We do not make automated decisions with legal effects: the AI produces training and nutrition recommendations, not refusals of service.

5. Who we share data with

We do not sell data. Access is limited to the services the platform cannot run without and to ad networks, within the limits described below and in section 9:

Anthropic (Claude), USA — processing chat messages, photos and lab results for the AI mentor. Only with your consent; the 7-day sleep-program summary only when both switches are on (section 3.1). Under Anthropic's terms this data is not used to train models.
ElevenLabs, USA — synthesising Aram's voice for lessons and your personal greeting; your name is sent to the synthesis.
Cloudflare, USA — storing and serving course video and audio (R2 and CDN), and holding off-site copies of platform backups in a private, key-access bucket.
Mapbox, USA — the map of your running route; the track coordinates are sent to Mapbox to render it.
Open-Meteo, EU — weather on the route; coordinates are sent, without your name or account.
Paddle, United Kingdom — accepting card, Apple Pay, Google Pay and PayPal payments, invoicing and tax. Paddle acts as merchant of record and handles card details itself.
Lava (lava.top), Russia — accepting Russian card and SBP payments.
Plisio — accepting USDT payments.
Apple — purchases and subscriptions in the iPhone app. We receive subscription status from Apple; Apple does not receive your health data from us.
Brevo (France) and Zoho — sending email: sign-in codes, subscription notifications, newsletters.
Hetzner, Germany — the server the platform runs on and where your data lives.
Meta, Google and Yandex — analytics and advertising pixels on the public site, only after your consent (section 9). They are not present in the web account.
Meta (Conversions API) — if you accepted cookies on the site and then paid for a subscription on the site, our server tells Meta about the payment: amount, plan and your email and account number hashed with SHA-256, plus the browser identifier from Meta's cookie and the browser type. This lets the ad see that it worked. Without cookie consent nothing is sent.
Meta and TikTok (SDKs in the iPhone app) — app events: install, launch, registration, trial start, subscription. The device advertising identifier (IDFA) only if you tapped "Allow" in Apple's tracking prompt (section 9).
Oura, WHOOP, Google Health (Fitbit), Withings, Garmin, Polar — only if you connected the device yourself: we receive sleep summaries from them, and they receive from us only a data request using your key (section 3.1).

We also disclose data where required by law, a court, or a competent authority.

6. International transfers

The platform runs on a server in Germany (Hetzner). Some of the services in section 5 are outside the EU and the UAE — chiefly in the USA. For those transfers we rely on the EU Standard Contractual Clauses in our agreements with them, and for health data additionally on your explicit consent. Paying with a Russian card means payment data goes to Russia: that is your choice of payment method, and you can always use a card or crypto instead.

7. Retention, and what survives deletion

Data is kept while your account is active. You can delete it yourself: your account → "My data" → "Danger zone", confirmed with a code sent to your email. In the same place you can end all sessions if you suspect someone else has signed in.

What actually happens on deletion:

Immediately and irreversibly: your profile and intake form, measurements and progress, every uploaded photo and lab report, and the entire mentor conversation.
Sleep program data — night summaries and diary 400 days, resting heart rate and heart-rate variability 30 nights, weekly summaries 26 weeks, the last 20 questionnaire results, the last 200 alarm and program event records; access keys to wearables for as long as the device is connected. You can export your sleep data in the program: "Profile → Export data" (JSON or CSV). "Delete sleep data" removes the program file, wearable keys and the sleep time the program wrote to your account immediately and permanently (except backups within the periods above). Export and deletion work even if the program is closed to you.
Up to 7 days: deleted data still exists in the daily backups on the server.
Up to 60 days: in the off-site copies on Cloudflare R2. Data is never restored from backups into live use; after that window the copies are erased.
Up to 90 days: technical logs keep service records of account events — identifier, email, IP address. We use them only to investigate failures and abuse.
Payment history — who paid, when and how much — is kept for as long as tax and accounting law requires. That is not our choice.

8. Your rights

get a copy of your data — a single-file export in your account and in the app, or on request by email;
correct inaccurate data — directly in your profile;
delete your account and data — the button in your account (see section 7);
withdraw consent for health data and the AI mentor — your account, "My data";
restrict processing or object to it;
unsubscribe from any non-service email in one click;
complain to a supervisory authority: in the EU, your national data protection authority; in the UAE, the UAE Data Office; in Russia, Roskomnadzor.

We answer requests within 30 days. We verify identity with a code sent to the email linked to the account, so that nobody else receives your data.

9. Cookies, analytics, pixels and in-app advertising

In the web account, cookies and localStorage are purely technical: they keep your session and remember settings and progress. There is no analytics and there are no advertising pixels in the account area.

On the public site — the landing page, the blog, these pages — a banner appears on your first visit. Until you press "Accept", no third-party script loads at all: no pixel, no counter. After consent, these are enabled:

Meta Pixel (ID 1623600489194781) — measuring Facebook and Instagram ad performance and showing ads to people who visited the site;
Google Analytics 4 (G-PHH8FB61E7) — visit statistics;
Yandex.Metrica (111250143) — visit statistics and on-page behaviour maps.

These services receive your IP address, a browser identifier and the pages you viewed, and process them under their own policies — Meta, Google and Yandex respectively. You can withdraw consent by clearing site data in your browser: the banner reappears and you can choose again.

The iPhone app. The app includes the Meta SDK and the TikTok Business SDK. They send Meta and TikTok app events — install, launch, registration, trial start, subscription start and renewal — together with technical device data (model, iOS version, language, IP address). This tells us which ads bring people in, so the budget is not wasted. Purchases are processed by Apple; neither we nor Meta nor TikTok receive card details.

After the questionnaire the app shows Apple's system prompt "Allow tracking?" once. If you tap "Allow", the SDKs receive the device advertising identifier (IDFA). If you tap "Ask App Not to Track", the IDFA is not shared and iOS blocks data from reaching Meta's and TikTok's tracking domains; advertising gets only Apple's anonymised statistics (SKAdNetwork). You can change your mind at any time: iPhone Settings → Privacy & Security → Tracking. Health data, photos, lab results and your chat with the coach are never shared with Meta or TikTok.

10. How we protect data

Connections are encrypted (HTTPS) and server access is by key and limited to a small circle. We store no passwords at all: you sign in with an email code or through Google, Apple or Telegram. Backups live in private storage with key-based access. No protection is perfect, which is what section 11 is for.

11. If there is a breach

If personal data is breached, we notify the supervisory authority within 72 hours of becoming aware (GDPR Art. 33) and the UAE Data Office without undue delay under the PDPL. If the breach puts you at real risk, we write to you personally — by email and in your account: what happened, which data is affected, what we are doing and what you should do.

12. Changes and contact

We update this policy as the product changes. We will notify you of material changes by email. Questions and data requests — support@jointhe1empire.com.